Model Context Protocol (MCP): How Anthropic's Open AI Standard Works

Until recently, getting an AI assistant to talk to your enterprise database, GitHub repository, or Slack channel meant writing custom, brittle API wrappers for every single tool and model provider. Anthropic introduced the Model Context Protocol (MCP) — a universal, open-source standard designed to connect AI applications to external data sources and execution environments.

Often described by engineers as the "USB-C port for AI applications," MCP replaces fragmented proprietary connectors with a single plug-and-play protocol that works across Claude Desktop, developer IDEs, and autonomous agent frameworks.

The N×M fragmentation problem: why AI needed a universal standard

As large language models became more capable, the primary bottleneck shifted from model intelligence to context accessibility. An AI assistant is only as useful as the live context it can access — whether that is current documentation, live production logs, customer records, or codebase files.

Before MCP, the AI ecosystem faced what computer scientists call the N × M integration problem:

• If there are N AI developer platforms (Claude Desktop, Cursor, ChatGPT, Zed, customized internal agents)...
• And M enterprise tools and data sources (Postgres, Snowflake, Notion, GitHub, Salesforce, Linear)...
• Developers had to build and maintain N × M distinct integrations, each with its own authentication flow, schema format, and error handling.

MCP turns this into an N + M problem. A database vendor or tool creator writes one MCP server. Once published, any MCP-compatible AI client can immediately discover its schemas, read its data, and call its functions safely.

How MCP works: client, host, and server architecture

MCP uses a clean, decoupled architecture consisting of three primary layers:

The three core MCP primitives: Resources, Tools, and Prompts

To keep integrations structured and secure, MCP standardizes three core types of capabilities:

• 1. Resources (Read-Only Data): Resources expose passive, file-like data feeds and document schemas to the AI. Examples include reading application log files, querying database schema definitions, or pulling API documentation. Because resources are read-only, they carry low security risk.
• 2. Tools (Executable Actions): Tools are functions that the AI model can invoke to perform side-effects or fetch dynamic data. Examples include creating a GitHub pull request, sending a Slack message, or executing a SQL query. MCP hosts prompt the user with human-in-the-loop approval before executing any tool that could alter external state.
• 3. Prompts (Reusable Workflows): Prompts are pre-packaged slash-command templates and structured context workflows provided directly by the server. For instance, a Git MCP server might provide a /review-pr prompt that automatically gathers git diffs and structures an evaluation prompt for the model.

Transport protocols: Local stdio vs remote HTTP with SSE

MCP supports two standardized communication transports to handle both local and cloud-native workflows:

Practical example: connecting a local database to Claude Desktop

Connecting an MCP server to Claude Desktop is as simple as adding an entry to your local configuration file (claude_desktop_config.json).

Here is how a developer configures a local PostgreSQL server and a local Filesystem server:

{
  "mcpServers": {
    "postgres": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-postgres",
        "postgresql://localhost/mydb"
      ]
    },
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/username/Desktop"
      ]
    }
  }
}

Once saved, restarting Claude Desktop immediately surfaces hammer icons for the tools, allowing Claude to inspect database tables, run analytical queries, and reference local project folders directly within your conversations.

Security and privacy: how MCP preserves data boundaries

One of the biggest concerns with enterprise AI adoption is credential leakage and accidental data exposure. MCP addresses this through foundational architectural guarantees:

• Credentials stay local: When querying a local database or private repository, your database passwords, tokens, and SSH keys remain strictly on your local machine. The AI model only receives the specific text chunks or query results returned by the server.
• Granular permission gates: Host applications enforce human confirmation before executing any tool that writes or deletes data.
• Isolated execution: MCP servers run in their own sandboxed processes, preventing unapproved cross-talk between different data sources.

Ecosystem adoption: who is building with MCP?

Anthropic released MCP under the open-source MIT license and published official SDKs for TypeScript, Python, and Kotlin.

The protocol has seen swift adoption across developer tools and software engineering platforms:

• IDEs & Editors: Code editors including Zed, Replit, Sourcegraph Amp, and developer agent frameworks have added native MCP client support.
• Pre-Built Open Servers: The open-source community and Anthropic maintain ready-to-use servers for GitHub, Slack, Google Drive, Brave Search, Puppeteer, Memory, and PostgreSQL.
• Enterprise Tooling: Financial tech company Block and enterprise API platform Apollo GraphQL are among the early adopters standardizing their internal LLM integrations around MCP.

Frequently asked questions

Related articles